A guide to successful internal auditing

Whatever your industry, seeking out continuous improvement is vital to your business’ success. One of the most effective ways to do this is to appoint an internal auditor within your staff, or to hire a third-party internal auditor. The internal auditor acts as a fresh set of eyes on your established processes, reviewing day-to-day behaviour to see if:

Processes are being followed

Processes are still effective/relevant

Risks occur during these processes

Output is of a consistently high standard

Depending on your industry, different departments within your business may need internal audits more frequently than others.

Once you have your list of areas and processes in place, you can plan out how frequently they require auditing. With this information, you can create an Internal Auditing Calendar for the year.

Internal Auditing Calendar

It is important to treat internal audits as a necessity, and not as an additional process outside of the business model. Drawing up a calendar ensures that the audits will be completed on time and frequently.

Using an audit calendar will also allow you to alert the next department to be audited in advance, which is recommended so that they can prepare the correct documentation for you to review. It also gives the internal auditor a chance to locate the process documents and review how the process should be followed and write up relevant questions, before they observe it in action.

The internal audit process

Observation and interview

With questions in hand, the internal auditor should then monitor the employee performing a given process, preferably in a natural scenario (i.e. the task needed doing that day). Asking the employee questions about the process they are performing will give the auditor insight as to whether or not the member of staff is, a) following the process properly, and, b) understands the process and the risks it is designed to mitigate.

Depending on the answers, the auditor can make note of areas that may need refresher sessions, or aspects of the process that may not have aged well (such as inefficient practices compared to technology that has been brought into the workplace).

Report write-up

With the observation and interview process complete, the internal auditor needs to write-up their findings and highlight any areas of concern.

Again, the report document can be as simple or as detailed as you require, so long as the findings are recorded. In the event of a process found to be non-compliant, the auditor will need to recommend further measures in an action plan. They may also need to raise a Non-Compliance Report, depending on your company and its quality compliance measures and recognitions:

Action plan

Working alongside the respective head of department, an action plan can then be put together to address any shortcomings or risks highlighted in the internal audit. This should include the finding, the corrective action, who will take ownership of implementing the corrective action, and the deadline for doing so. There should also be a follow-up date to ensure the corrective action has been applied:

The process of internal auditing is a benefit to any business, and it should be implemented as a critical procedure, and not simply as something to tick off in the books!